Drift Protocol Hacked for $280M — North Korean Operatives Spent 6 Months Undercover Inside Team

The crypto industry was rocked this week by one of the most sophisticated exchange hacks in history: Drift Protocol, a Solana-based perpetual DEX, was drained of $280 million in what investigators are calling a state-sponsored social engineering attack orchestrated by North Korea's Lazarus Group. Unlike traditional smart contract exploits, this attack relied on human infiltration: two North Korean operatives spent approximately six months working as legitimate remote contractors within Drift's development team, building trust before simultaneously draining the protocol's treasury and insurance fund. The operatives had passed standard KYC verification using sophisticated AI-generated fake identities and forged South Korean passports — a new frontier in state-sponsored crypto theft. On-chain data shows the funds were initially moved to a single intermediary wallet before being split across 47 addresses using a mix of Tornado Cash forks and cross-chain bridges to Ethereum and Avalanche. Drift has paused all protocol operations and is working with Chainalysis, the FBI, and the South Korean National Intelligence Service to trace the funds. The incident has sent shockwaves through the Solana DeFi ecosystem, with $890M being withdrawn from Solana DeFi protocols in the 48 hours following the announcement. Regulators are using the incident to push for mandatory background check standards for crypto developers accessing treasury systems — a proposal the industry has historically resisted on privacy grounds.